# CVE-2026-119576: ArcadeDB authorization bypass in GraphQL schema endpoint

Source: https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119576 · Severity: medium · CVSS 4.3 · Published 2026-10-30

ArcadeDB is a multi-model database that supports GraphQL queries. A user with read-only permissions can exploit an authorization bypass to replace the shared GraphQL schema, allowing them to alter query results seen by other users including administrators. This could be used to inject false data into reports or analytics that depend on GraphQL queries.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-119576 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119576 being exploited in the wild.

**How severe is CVE-2026-119576?** Medium severity, with a CVSS score of 4.3, published 30 October 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB 21.12.1 to 26.10.1.

**Is there a fix for CVE-2026-119576?** Yes: fixed in 26.10.2. Until then: Upgrade to version 26.10.2 or later. On earlier versions, restrict GraphQL exposure to only trusted users who are permitted to alter the schema, or disable the GraphQL module entirely if not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119576 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119576?** Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.10.2

Upgrade to version 26.10.2 or later. On earlier versions, restrict GraphQL exposure to only trusted users who are permitted to alter the schema, or disable the GraphQL module entirely if not required.

## Technical details

A low-privilege user holding only readRecord permissions can send a GraphQL type definition with a crafted @sql directive to the read-only /api/v1/query/{database} endpoint, bypassing the authorization check that normally requires updateSchema rights to modify the schema. When other users execute subsequent GraphQL queries, they receive results defined by the attacker's injected @sql statement rather than legitimate data. The vulnerability affects arcadedb-graphql versions 21.12.1 through 26.10.1 and is fixed in 26.10.2.

## Affected products

- ArcadeData ArcadeDB 21.12.1 to 26.10.1

## Timeline

- 2026-10-15: disclosed
- 2026-10-30: advisory

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-773f-9j7c-cr54](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-773f-9j7c-cr54)
- [https://www.vulncheck.com/advisories/arcadedb-from-21.12.1-before-26.10.2-graphql-schema-replacement-via-read-only-query-endpoint](https://www.vulncheck.com/advisories/arcadedb-from-21.12.1-before-26.10.2-graphql-schema-replacement-via-read-only-query-endpoint)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)
- [ArcadeDB missing authorization in Bolt protocol handler](https://junglewise.ai/threats/cve-2026-114057-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)